General
- Target seon_test
- Size 62KB
- Sample210407-d8m3becbre
- SHA256 221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea
Score
10/10
Malware Config
Extracted
Path
-
C:\MSOCache\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- SEON RANSOMWARE ver 0.2 all your files has been encrypted There is only way to get your files back: contact with us and pay $1500 We accept Bitcoin and other cryptocurrencies Do not try to reinstall operation system on your computer Do not try to decrypt files with third party tools, this can lead to data loss You can decrypt 1 file for free Our contact emails: [email protected] [email protected]
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\readme.hta
Ransom Note
- All your documents, photos, databases and other important files have been encrypted and you can't decrypt it yourself. No one but us can return your files. Free decryption utility does not exist. Each file is encrypted with its unique key, cryptography based on elliptic curves, key recovery is impossible. Focus on the problem, follow your instructions and everything will be fine. DON'T PANIC! YOU CAN RETURN ALL YOUR FILES! FREE decrypting as guarantee You can test decryption 1 any file for free (with help our special software " SEON Decryptor "). What to do? First you should write me and i'll send you a special software " SEON Decryptor " (this software needed to decrypt encrypted files). To start the process of decrypting ALL files, you need buy key to the " SEON Decryptor ". The price is $1500 in any cryptocurrency . Contacts E-Mail: [email protected] E-Mail: [email protected] Attention! Decryption keys are individual, the keys of other users will not work for you Do not try to decrypt files with third party tools, this can lead to data loss Do not try to reinstall operation system on your computer
Targets
-
- Target seon_test
- Size 62KB
- SHA256 221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea
Score10/10-
Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.